Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Software security suffers as startups lose access to Google’s virus data

venturebeat.com

Post reply on HN
Print view View original

21–27 of 27 posts

Re: Software security suffers as startups lose access to Google’s virus data

#21

Post by pandemicsyn »

iancarroll wrote: post #17
newjersey wrote: post #5

Earlier quoted context omitted.

Sentinel One's position didn't make sense to me. > “We were more than willing to work with them, but they didn’t have a way for us,” said Tomer Weingarten, chief executive of SentinelOne, a firm that acknowledges it was cut off from the feed against its will. “This is a step back.” > Weingarten said SentinelOne had added a new data feed to replace VirusTotal and predicted that VirusTotal will become less relevant as…

It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.

Yup, that seems likely. Their whole shtick is that signature based checks don't cut it and that their behavior based system is the way to go.

https://en.wikipedia.org/wiki/SentinelOne#Technology

https://www.sentinelone.com

Re: Software security suffers as startups lose access to Google’s virus data

#22

Post by matt_wulfeck »

> On Wednesday, the 12-year-old service quietly said it would cut off unlimited ratings access to companies that do not share their own evaluations of submitted samples.

Not sure why the headline spins google as the bad guy here. The system works best if all companies contribute, and clearly there's some who are not contributing.

Re: Software security suffers as startups lose access to Google’s virus data

#24

Post by nickcano »

cleverfoo wrote: post #18

Let me see if I can try to simplify the underlying problem here (I dabble in this space): Little bit os background: writing pattern matching signatures is hard, adding a bunch of "known malicious" hashes to your malware database is easy. So, company A with a staff of folks writing pattern matching signatures has its engine added to VirusTotal and virus total shares/sell hashes found by that engine to folks that pay f…

>bullet proof since it's likely that any sample used to test its effectiveness will be run by VirusTotal first.

Nope. There are lots of situations where exploit kits will automatically re-compile and re-pack malware on-demand in ways sufficiently complex that they eliminate any signatures and evade AV detection.

A lot of companies are using VT as a filter for known bad to prevent even having to deal with such samples, but many unknown bad samples still exist and make it past the VT engine, only to be picked up by behavioral detection.

Conversely, a small number of known bad samples that are caught by VT can slip by behavioral detection engines that are gated by VT, causing infection (when VT is removed) where it would otherwise be prevented. Of course, in these cases, it is the fault of the behavioral vendor for not having sufficient behavioral detection, but relying on VT does make that easier. For instance, many companies have a loop where they can take samples detected by VT, run them constantly through an automated analysis lab, and see whether or not their behavioral analysis detects each sample. In the cases where it fails, that sample has a direct line to analysts who can reverse engineer it, come up with new behavioral patterns, and add it to training sets for any machine learning based detection. In this sense, not having VT support makes everything less safe.

The next issue is that companies like this simply can't be run on VT's platform because they're too heavy, as the article mentions. I think a good middle ground here would be to turn this analysis loop into a feedback loop by adding one more step: in cases where behavioral detects and VT does not, submit the report to VT in a standardized format so it can be added to their corpus.

Re: Software security suffers as startups lose access to Google’s virus data

#25

Post by sjg007 »

iancarroll wrote: post #17
newjersey wrote: post #5

Earlier quoted context omitted.

Sentinel One's position didn't make sense to me. > “We were more than willing to work with them, but they didn’t have a way for us,” said Tomer Weingarten, chief executive of SentinelOne, a firm that acknowledges it was cut off from the feed against its will. “This is a step back.” > Weingarten said SentinelOne had added a new data feed to replace VirusTotal and predicted that VirusTotal will become less relevant as…

It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.

Sure but then generate a signature and submit it.

Re: Software security suffers as startups lose access to Google’s virus data

#26

Post by iancarroll »

sjg007 wrote: post #25
iancarroll wrote: post #17

Earlier quoted context omitted.

It's likely they are using an engine based almost entirely on run-time heuristics - that is, stopping malware when it behaves suspiciously. VirusTotal does "scan-time" analysis of files where the file is never run, only checked against AVs. If they have no "traditional" signatures, they wouldn't be compatible with this method.

Sure but then generate a signature and submit it.

It's not really that easy...
Post reply on HN